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To provide a summary of the proposals 
for an interim organizational structure 
that can coordinate and direct the 

•i 

defense of DOD Computer Networks 
and Systems until superseded by a 

long - term solution 
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Completed l Requested Actions 


I 


* DEPOPSDEPS: Review brief to be presented to OPSDEPS 

* OPSDEPS: 




□ 

□ 

□ 


- Conceptually approve organizational structure options 

- Review brief to be presented to Unified Commands, reconvene to 
review comments and recommend option for CND structure 

Unified Commands: Provide comments /recommendations on VTC 
presentations 

DEPOPSDEPS: Approve recommended strategy for final option development 
DJS Meeting : Options reviewed, narrowed to two finalists 
OPSDEPS: Discuss final option for recommendation to JCS 

ACOM J3/5 Provide comments and recommendations 
Unified Commands: Provide comments 
JCS Tank: Approve recommendation 
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Evolution of Options 
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Jim 97 
EFll97 


5&p 97 
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Jun 96 



Solar Sunrise 


_k 


T 


NOv 97 NOv 97 

DEPQPSDEPS QPSDEPS 


99 process 


Dec 97 Fab 90 
UCF&vfSw DEPQPSDEPS 


Apr 98 
QPSDEPS 


1. Continue with JS IORC 

2. Assign to an Agency 

3. Establish a Contingency JTF (JSIOFIC +} 

4. Build a Standing JTF 

5. Assign to CINC 




4. JS IORC + 

5. Joint Staff 


1. Washington Based 

2, JC2WC Based Sfl 

Final Recommendation 
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Results from 19 May DJS Meetin 


V 


ifm 


* Representatives from each of the proposed 
organizations participated 


* Consensus that this organization must plug into an 
umbrella organization which can, if required, be DOD 
focal point for coordination with National 
Infrastructure Protection Center 


* Must still retain operational focus 

* Narrowed to two options: 

- San Antonio-based JTF organized around JC2WC 

- Washington-based JTF (hybrid of previous proposals) 

* Next step: OPSDEPS tank session 
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Proposed CND-JTF Mission 

II 


“Subject to the authority, direction, and 
control of the SECDEF, this organization will 
be responsible for coordinating and directing 
the defense of DOD computer systems and 
computer networks. This mission includes 
the coordination of DOD defensive actions 
with non - DOD government agencies and 
appropriate private organizations.” 
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lc Organizational Functions 


* Organize, plan, and participate in joint training to conduct strategic CND 

- Monitor Intelligence Community ] & W reporting 

- Provide Intelligence Community with PIR for collection and I & W requirements for 
potential attacks against DOD computers and networks 

* Monitor status of DOD computer networks 

■ Determine when system(s) are under attack, assess operational impact, and notify 
NCA and user community 

* Coordinate / direct appropriate DOD actions to stop attack, contain damage, restore 
functionality, and provide feedback to user community 

' Coordinate with Defense - wide information Assurance Program (DIAP) and Critical 
Asset Assurance Program (CAAP) authorities to ensure compliance with wider 1A 
policy and initiatives 

* Coordinate as required with NSC, NIPC, law enforcement agencies, other 
Interagency partners, private sector, and allies 

* Assess effectiveness of defensive actions and maintain current assessment of 
operational impact on DOD 

* Subject to authority, direction, and control of SECDEF, provide information to and 
receive direction from the CJCS, and provide liaison as required to the OSD staff 
and Joint Chiefs of Staff 
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I 


* Presidential Decision Directive 63 {22 May 98) 

- National Coordinator 

- National Infrastructure Protection Center (NIPC) 

- Department Implementation Plans w/in 180 days 
(ODUSD lead) 
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Migrant 

Operations 


Counter 

Drugs 


Deterrence 


Civil 

Disturbance 


Border 


Homeland Defense 


^ Critical Infrastructure Protection 

Count / information 

. Operations JMBLZZm. 
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Policy Issues 


Info Operations 

* CND first 

* Ml PC coordination 

{potential DoD equivalent 
to NtPC) 


Integration 

* Active 

* Reserve 
Component 


STATUTORY 


Titles 10, 18, 32 
IntT Agreements 


UCP PROCESS 


CONSEQUENCE MANAGEMENT 


COMMAND STRUCTURES 


SECARMY Executive Agent 
Revise DOD Policy Documents 
Revise Forces For Memo 
Interagency coordination 


Counterdrugs JIATF / JTFs 
ACOM RTFs (includes CBIRFs, etc) 
Existing MOAs / MOUs 
SACLANT/ NORAD 


UNCLASSIFIED 


UNCLASSIFIED 



























UNCLASSIFIED 


Operational Coordination 


I 


mm? 


Inter-Agency 

1 1 

Department of Defense f 


CRITICAL 

INFRASTRUCTURES 


Financial 


Transportation 


Electric Power 


5 


Cnmmtinina tinn^z 


3 


Gas^Oii 


I E mg G ij tf S ervi — 


Emg Health Serv- 

- Water - 


N1PC 



NATIONAL 


SECDEF 

COORDINATOR 

i 

I 


CJCS 

1 


Operahongl 

Coordination 


DISA GOSC 


NSA 

Collateral 


Gompartmented 

Networks 


Networks 
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COMMANDS 
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JC2WC Proposal 

CONCEPT: 

‘ San Antonio based JTF leveraging existing relationships and personnel 
REQUIREMENTS: 

* Personnel 

‘ 23 JC2WC / 20 AFIWC billets 

* 9 additional personnel (requires reps from DISA, NAVCIRT, & ACERT) 

■ $5M start up / $3M recurring 
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JC2WC Proposal 


I 


CONCEPT: 

* San Antonio based JTF leveraging existing relationships and personnel 
REQUIREMENTS: 

* Personnel 

* 23 JG2WC/ 20 AFIWC billets 

* 9 additional personnel (requires reps from DISA, NAVCIRT, & AGERT) 

* $5M start up / $3M recurring 
PROS: 

* Existing JC2WC relationships with CINCs 

* Basic 24 x 7 Watch with AF support (AFIWC/AIA) 

* Connectivity in-place now or programmed with Services and Agencies 

* Available office / watch center space (AFIWC) 

‘ Significant personnel commitment (20 AF / 23 JC2WC) 

* Synergy of JC2WC / AIA l AFIWC co-location 

* Quickest start-up: immediate cadre available 
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JC2WC Proposal 

CONCEPT: 

* San Antonio based JTF leveraging existing relationships and personnel 
REQUIREMENTS: 

* Personnel 

* 23 JC2WC / 20 AFIWC billets 

* 9 additional personnel (requires reps from DISA, NAVCIRT, & ACERT) 

* $5M start up / $3M recurring 
PROS: 

* Existing JC2WC relationships with CINCs 

* Basis 24 x 7 Watch with AF support (AF1WC/A1A) 

* Connectivity in-place now or programmed with Services and Agencies 

* Available office / watch center space (AFIWC) 

* Significant personnel commitment (20 AF / 23 JC2WC) 

- Synergy of JC2WC / AIA / AFIWC co-location 

* Quickest start-up: immediate cadre available 
CONS: 

- Washington DC detachment required for interagency coordination 

* JC2WC support for OSD ACTDs impacted: need to transfer responsibility or backfill 
JC2WC billets to maintain ACTD support capability 

* Minimal (baseline) operational capability; some surge capability 
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JC2WC IOC Milestones 


I 


Milestone\ Date: 31 May 15 Jun 


Jul 

Decision A 

L j i 

AlCTD Work-stop Approved 

: 

A 

Initial Funding Avail (S2,000k) 

! 

1 

Spaces Available 

Hardware 

Connectivity (see notes) 

P 

j 

1 

i 

Manpower 

DC JTF, OPS, Admin 

Analysts (see notes) 

| 

3 

VJ-..-—..... 

j 

1 

Implementation Plan (Draft) — 

Proposed Charter (Draft) 


vi.. r-ii .. r-i i . ■ . . 

i 

j 

1 

i 

j 


30 Jun 15 Jul 31 


! ! ! 



Initial Operational Capability (31 July 1996) defined as baseline correlation, analysis, reporting and monitoring / coordinating incident 
response activities. Initial operations will be less than continuous 24 x 7 due to manpower availability, skill levels, and additional 
requirements associated with stand-up of the JTF (developing policy/ doctrine guidance, coordination with other CERTs / agencies). Early 
operations will leverage off current AFCERTand AIA/ IOC activities £co-located) but virtual and physical representation of NAVGIRT/ 
ACERT /DISA network status is required at IOC. Expanded capabilities available at follow-on intervals based on manpower availability and 
skills, space and hardware procurement, connectivity, and funding. 
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JTF Impact On Current JC2WC Mission 

II 


* Current Mission Area Trade-Offs 

* Assessing ACTD 10 Vulnerabilities (5 billets); tasked by 0SD/C3I 

* Executing ACTD and other technology demonstrations (13 
billets); tasked in the current JC2WC charter 

* Impact of mission deletion 

’ OSD will have to transfer analytical vulnerabilities responsibilities 
elsewhere 

* The Joint honest broker bridge between CINCS and the R&D 
community will be severed for ACTD and technology 
demonstration 


* May be able to cover some of these impacts in ACOM transfer 
.. .we should be willing to backfill where required 
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JC2WC Proposal 



JC2WC/CC 


Deputy GJTF 
Admin 


I 

DC Del 

DepCJTF # 
OIC 1 

OPS 3 

Intel II 

Plans 2 

IOTC 1 

JWAC 1 

ADMIN 1 


o i a y n a /"s a 1 

’ 

SJA l PAO 21 

1 


Total: 

JC2WC; 

A1A: 

TBD: 


52 

23 

20 

9 


TOT 


10 


** USAF will source 
@ Contractors 

# Will deploy from SA as required. 



Operations 


Watch Commander 

5 

Watch NCO \ 

c 

OPS Analysts / 
Network Analysts \ 
DISA / 

o 

5@ 

AFCERT Analyst ^ 
(NAVCIRT) 

(ACERT) J 

Law Enforcement 

S 

TOT 

25 



Plans 


Counter Off 

3 

Counter Off 

2 

Network Resp 

2 

TOT 

7 


NOTE: 43 of the 52 billets 
are currently at San 
Antonio 
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-Based Proposal 

■ ■■■■■III 

CONCEPT 

* Washington-based JTF; synthesis of previous proposals 

* Based within DISA facilities but not part of DISA 

* Capitalize on synergies of DISA co-location 

* DISA provides facility, connectivity, synergy, some personnel, and support 
for JTF 

REQUIREMENTS 
‘ 29 Personnel (4 from DISA) 

‘ Minimal S3M start-up, $2M recurring 
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•Based Proposal 

■■■■mu 

CONCEPT 

* Washington-based JTF; synthesis of previous proposals 

* Based within DIS A facilities but not part of DISA 

* Capitalize on synergies of DISA co-location 

* DISA provides facility, connectivity, synergy, some personnel, and support 
for JTF 

REQUIREMENTS 

* 29 Personnel (4 from DISA) 

* Minima] $3M start-up, $2M recurring 

PROS 

- Resident CND capability (ASSIST, DIAMOND, R & D) 

* Basic 24 x 7 Watch with DISA support 

- Global network management infrastructure 

* Established relationships with CINCs, DOD, and Interagency activities 

* Available office/watch center space 

* Connectivity in - place now or programmed 
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Washington-Based Proposal 

II 


CONCEPT 

* Washington-based JTF; synthesis of previous proposals 

* Based within DISA facilities but not part of DISA 

* Capitalize on synergies of DISA co-location 

• DISA provides facility, connectivity, synergy, some personnel, and support 
for JTF 

REQUIREMENTS 

* 29 Personnel (4 from DISA) 

* Minimal $3M start-up, $2M recurring 
PROS 

* Resident CND capability (ASSIST, DIAMOND, R & D) 

* Basic 24 x 7 Watch with DISA support 

* Global network management infrastructure 

* Established relationships with CiNCs, DOD, and Interagency activities 

* Available off ice / watch center space 

* Connectivity in - place now or programmed 

CONS 

* Significant manpower requirement 

‘ Start-up time TBD: no personnel identified 

* Minimal (baseline) operational capability; no surge capability 
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Washington-Based Proposal 
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Personnel 

Provided 

Comms 

needed 

Facility 

needed 

Start-up 

Costs 

Recurring 

Costs 


JTF Resource Matrix 

■■■■■■■■■III 


JC2WC 

DC-based 

52 

33 

43 

4 

yes 

yes 


no 

no 

AFIWC 

DISA 

$5M 

$3M 

$3M 

$2M 
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I 


0 PSD EPS endorse JC2WC-based 
option as best interim organization 
to direct Computer Network Defense 
for DOD. 
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Way - Ahead 

■ ■■■■■III 


■ Meet with ACOM to discuss JC2WC proposal 

■ VTC with Unified Commands for comment 
* Present at JCS Tank for final approval 
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